photo
Jordan Sissel
geek

Sun, 03 Jul 2005

Using PF/ALTQ to make slow connections better

ALTQ is a quality of service packet scheduler for OpenBSD pf (pf works in FreeBSD too). I'm at home right now on DSL. DSL is just fine when the only thing I'm doing is ssh and light web usage. However, once I start a download all of the bandwidth I've got ends up being used by that download. The problem is, then, that my ssh sessions become unnecessarily sluggish due to the fact that things are now having to compete for the transmission queue.

If only there were a way to give things like ACKs and ssh sessions higher priority? Oh wait, there is! PF/ALTQ to the rescue. With very minimal effort, you can effectively make your ssh sessions usable once again even though you're downloading or uploading enough to fill your pipe.

My pf.conf is as follows:

ext_if=em0

# Make a priority queue with 3 members: q_ack, q_pri, and q_def
altq on $ext_if priq bandwidth 100% queue { q_ack, q_pri, q_def }

# Give priorities
queue q_ack priority 10
queue q_pri priority 7
queue q_def priority 1 priq(default)

# ACKs get high priority
pass out on $ext_if proto tcp from $ext_if to any flags S/SA keep state queue (q_def, q_ack)
pass in  on $ext_if proto tcp from any to $ext_if flags S/SA keep state queue (q_def, q_ack)

# SSH sessions also want priority
pass out on $ext_if proto tcp from any to any port 22 keep state queue q_pri
You'll need the ALTQ and ALTQ_PRIQ options in your kernel for this to actually work. ALTQ cannot be built as a module under FreeBSD due to the way it is implemented.

If I turn pf on, and start a long file transfer (up or down), my ssh sessions won't lag anymore.

Comments: 0 (view comments)
Tags:
Permalink: /geekery/179
posted at: 01:36


0 responses to 'Using PF/ALTQ to make slow connections better'


Leave a reply

You need javascript enabled to use this form. Anti-spam efforts ongoing. Also, if the comment doesn't show up, it's because the form expired. Go back and copy your comment, reload the form, and resubmit. Apologies if this is a hassle, I'm just playing with antispam methods right now. If this insists on not working, please email me about it.

Name (required)
E-mail (optional, if you want me to be able to email you back)
URL (also optional)
Comment:


Search this site

Navigation

Metadata

Home About Resume My Code (SVN)

Articles

ARP Security Dynamic DNS with DHCP OpenLDAP+Kerberos+SASL PPP over SSH SSH Security: /bin/false Week of Unix Tools Work Efficiency

Projects

fex firefox tabsearch firefox urledit grok keynav liboverride newpsm (FreeBSD) nis2ldap pam_captcha poor man's backup Solaris audio utility xboxproxy xdotool xmlpresenter xpathtool misc scripts

Presentations

Yahoo! Hack Day '08 Yahoo! Hack Day '06 Unix Essentials Vi/Vim Essentials SSH Tunneling (Video)

Tag Cloud

Calendar

< July 2005 >
SuMoTuWeThFrSa
      1 2
3 4 5 6 7 8 9
10111213141516
17181920212223
24252627282930
31      

Friends

BarCamp Kent Brewster Tantek Çelik John Resig Wesley Shields Tyler Shields

Technorati